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INTRODUCTION 

S ince the signing of the Higher Education Opportunity Act (HEOA) 
in August 2008, providers of distance education courses and pro- 
grams have been looking into procedures and technologies that 
will satisfy the accrediting agencies responsible for enforcing the 
law. Continuing education administrators are at the forefront because of 
the pervasiveness of distance learning in their programs. In order to make 
the most informed decisions and choose the most appropriate solutions for 
an institution, it is useful to understand the history of the legislation, and 
important to understand fully the issues associated with authentication. 

HISTORICAL CONTEXT OF THE ACT 

The HEOA, which is a reauthorization of the 1965 Higher Education Act 
(HEA), primarily regulates Title IV federal financial aid funding and ac- 
countability for higher education, including Pell grants and Stafford loans. 
This most recent legislation contains new language that has attracted a great 
deal of attention from the distance learning community, public and private 
alike. Under the section regarding accreditation and program integrity, the 
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language specifically states: 

The [accrediting] agency or association requires an insti- 
tution that offers distance education or correspondence 
education to have processes through which the institution 
establishes that the student who registers in a distance 
education or correspondence education course or program 
is the same student who participates in and completes the 
program and receives the academic credit. 

REGULATING FRAUD IN CORRESPONDENCE EDUCATION 

A 1992 amendment of the HEA included a provision that limited the amount 
of federal financial aid institutions could receive if the institution offered 
more than 50 percent of its courses or had more than 50 percent of its stu- 
dents through distance education. Known as the "50 percent rule," this part 
of the act reflected the concern that Title IV financial aid programs — includ- 
ing Stafford loans — had been subjected to fraud and abuse by institutions 
and individuals seeking to profit from the programs. A Senate report stated 
that there had been significant abuse reported, particularly within short- 
term correspondence programs where no degree was awarded. Legislators 
believed the remedy was to eliminate student aid for any correspondence 
course that was not part of an associate's or bachelor's degree program. 
The amendment prohibited aid for any institution offering more than 50 
percent of its courses through correspondence courses or enrolled more 
than 50 percent of its students in correspondence programs. 

Recognizing the political climate of 1992, during which the nation had 
its first Democratic president in 12 years, is important to understanding how 
the regulation pendulum swings depending on the political environment. 
Concerned with abuse of taxpayer monies, the Democratic administration 
wanted tighter financial regulatory controls to clean up occurrences of 
fraud in correspondence schools. While well intentioned, the 50 percent 
rule put access to education out of reach for many Americans at about the 
same time that online education began to replace correspondence education 
in the forefront of distance learning. The continuing education industry — 
including the for-profit virtual universities — viewed it as as too restrictive 
to meet student demand for anytime, anyplace learning adequately. 
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DEREGULATION AND THE RISE OF ONLINE LEARNING 

As online learning and virtual universities grew into viable enterprises for 
higher education, many burgeoning private educational interests, including 
Western Governor's University, Capella University, and the Sloan Con- 
sortium, began lobbying Congress to repeal the 50 percent rule. By 1998, 
organizations and institutions with online interests negotiated a federal 
distance education demonstration program by which institutions offering 
online degrees could request a waiver of the rule. The pilot program began 
with 24 colleges, including nine for-profit private, five for-profit publicly 
traded, seven private nonprofit, four public universities, one public system, 
and three consortia. Four of the institutions eventually left the program 
voluntarily and one institution was disqualified for abusing federal aid 
funds (Lederman). 

To participate in the demonstration program and receive a waiver from 
the 50 percent rule, institutional participants were required to demonstrate 
their programs' accountability and legitimacy by monitoring enrollment 
growth, student retention, and graduation rates. Most importantly, in the 
1998 HEOA, demonstration program participants were required to docu- 
ment "the number and types of students receiving assistance under this 
title for instruction leading to a recognized certificate ... including the 
progress of such students," and the increase in participation in the certifi- 
cate or degree programs. During the course of the seven-year program, the 
demand for 100 percent online learning at universities across the country 
was growing, and institutions did not have a way to respond within the 
limits of the rule. 

In 2002, as the Republican-led Congress worked on the next reau- 
thorization of the HEA, hearings were held to evaluate the success of the 
demonstration program. The General Accounting Office (GAO) cautioned 
legislators against relaxing regulations, testifying in a hearing before the 
Senate Committee on Health, Education, Labor, and Pensions that "the 
biggest challenge is how to help access to this form of higher education 
while still preventing fraud in the Title IV programs." During the session, 
the chancellor of Capella University noted that "the problems with fraud 
were vocational and correspondence schools, and that unlike them, online 
schools are accredited degree-granting institutions." Summarizing the goal 
of the hearing. Senator Paul Wellstone added, "the goal of government 
aid and oversight should be programs of good quality without onerous 
government regulations." 
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In a 2004 report on the state of distance-education accreditation over- 
sight and federal aid, the GAO indicated that stringent accountability and 
oversight were needed to ensure that student-learning outcomes were being 
met. The GAO insisted that universities work with accrediting agencies to 
develop best practices and procedures to monitor student retention and 
graduation in distance education programs. 

After three years of hearings, reports, and lobbying efforts from on- 
line educators, the Department of Education and legislators evaluated the 
demonstration program and deemed it to be a success. The financial aid 
restrictions were lifted, allowing institutions to offer 100 percent online and 
correspondence degree programs. 

Skeptics continued to question the ability of the government to police 
potential fraud and abuse from the proliferation of online learning. The 
GAO had sought greater accountability and reporting measures if the 50 
percent rule were lifted and some public, nonprofit universities were op- 
posed to a complete reversal of the law (Dillon). Questioning the political 
motives behind a change that was seen as benefitting for-profit higher 
education institutions, a New York Times columnist noted "the [demonstra- 
tion program] provision is just one sign of how an industry that once had a 
dubious reputation has gained new influence, with well-connected friends 
in the government and many Congressional Republicans sympathetic to 
their entrepreneurial ethic" (Dillon). While some saw the deregulation of 
financial aid pertaining to online learning as ripe for abuse and profiteer- 
ing, the distance learning community embraced the change that opened the 
opportunity to serve millions of students who otherwise would not have 
the ability to earn a college degree. 

A NEW ERA OF ACCOUNTABILITY 

In 2008 Congress passed the Higher Education Opportunity Act after strug- 
gling through years of drafts. By the time it passed under a now Democratic- 
controlled Congress, new language in the act reintroduced accountability, 
enforcing what the GAO had earlier recommended regarding oversight of 
distance education programs. By requiring accreditation agencies to oversee 
more closely the operation of distance education programs, institutions 
were now asked to have in place "processes by which it establishes that 
the student who registers in a distance education course or program is the 
same student who participates, completes academic work, and receives 
academic credit." 
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Technically the law only requires accreditors to evaluate and monitor 
distance education courses and programs within the institutions that they 
accredit. The effect on distance learning programs is that institutions are now 
required to produce evidence that they are able to ensure that their student 
authentication and identity processes are intact and effective. Providing this 
evidence can include — but not be limited to — secure logins with passwords 
and user IDs. The overarching concern of student authentication and iden- 
tity management is much larger than distance education; it is an issue that 
our institutions are struggling with as state and federal laws protecting data 
privacy in a technology-driven environment become stricter. 

UNDERSTANDING IDENTITY MANAGEMENT IN HIGHER EDU- 
CATION 

In order to understand fully the new law and what it means to ensure 
student authentication and identity in online learning, it is important to 
first understand identity management, which encompasses four sequential 
aspects: identification, authentication, authorization, and accountability. 
The act specifies only identification and authentication for distance educa- 
tion. 

The process of student identification means assigning a unique "identi- 
fier" to an individual user that distinguishes one person from another. On 
most campuses this is usually the user ID, which is specific to the individual 
and can be changed at will by the user, or when prompted by the campus IT 
administrator. Today, it would be unusual to find a US college or university 
that is not utilizing a secure login identification for campus registration, 
email, grades, or for entry into learning management systems. 

Authentication, the second step in the identity management process, 
ensures that the person using the identification code is the person to whom 
that code is assigned. Authentication can involve one or more of the follow- 
ing: something the person knows (password), something the person carries 
(identification card) or something about the person (physical characteristics 
like fingerprint or iris scan). 

This is the crucial step that will require close evaluation by our insti- 
tutions to ensure that the student who is completing the coursework is 
actually the same student who receives the credit. For now, the language 
in the HEOA indicates that the measures already in place at most institu- 
tions will suffice. As new technologies are developed that provide greater 
authentication and authorization, our campus IT and distance education 
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administrators will need to analyze and weigh carefully the benefits and 
risks to our institutions and students. 

IDENTIFYING THE SCOPE OF THE DILEMMA 

At first glance, the authentication element sounds like a cheating or test- 
ing issue, but upon closer examination, authenticating students in online 
courses is a larger and more complex problem that affects the fabric of higher 
education and how we traditionally teach and learn. At the 2009 conference 
of the University Continuing Education Association (UCEA), this issue was 
the topic of heated discussion among distance learning administrators, and 
of particular relevance to this article. Discussion began with authentica- 
tion tools and procedures and quickly moved to authentic assessment and 
online teaching and learning. Among the universities represented at the 
presentation, several have been testing and piloting high-tech authentication 
systems in order to reduce costs associated with traditional exam proctoring, 
increase legitimacy and security of their programs, and to manage growth 
more efficiently. Currently the majority of institutions represented at UCEA 
with online degree programs require proctored exams (primarily public 
universities) or have no proctored exam requirements (primarily private, 
for-profit universities). Few online graduate programs at any public or 
private institution were found to require exam proctoring since graduate- 
level courses typically assess students based on projects, papers, portfolios, 
and presentations rather than knowledge-based testing. 

Since subjective assessments in graduate courses rely upon the relation- 
ship between the instructor and the student to authenticate the student's 
identity, many administrators expressed concern about whether these 
courses would be considered compliant with the law. While some graduate 
courses require proctored exams, for the most part proctoring is a staple of 
undergraduate courses, comprising the majority of all online offerings. Con- 
ference attendees indicated that because proctoring was still commonplace 
at their institutions, they were particularly interested in learning more about 
authentication technologies available for use in proctored scenarios. 

For the time being, current authentication systems that rely on user 
IDs and passwords will be considered acceptable by accrediting agencies. 
However, new products and technologies have emerged that are being 
targeted to higher education for identity management purposes. Many 
institutions are looking at biometric systems, which create individually 
unique identifiers for employees and students. Physiological biometrics are 
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identifiers unique to an individual's physical characteristics — fingerprints, 
iris, and face recognition and speech (pitch) patterns. Abehavioral biometric 
is the unique behavior that each individual exhibits, including handwriting, 
typing, and even speaking patterns. 

HIGH-TECH SOLUTIONS 

Research on biometric student authentication systems indicates that a vari- 
ety of identification technologies are available for use in higher education, 
some of which are already familiar to us . These systems can be used anytime 
a student logs into the learning management system, in proctoring situa- 
tions, and during synchronous class sessions. These technologies include: 

• fingerprint scanning, 

• iris scanning, 

• keyboard typing cadence, 

• speech recognition, and 

• handwriting recognition. 

Non-biometric authentication technologies available for use include: 

• web cameras and microphones that visually record the stu- 
dent's testing environment, movements, and background 
noise; 

• onsite, remote proctors who monitor the student taking the 
exam at the student's location; 

• "out-of-wallet" data mining of personal data that randomly 
requires students to answer personal questions before or 
during the exam; 

• lockdown browsers that prohibit students from Internet 
browsing or instant messaging service while taking an exam 
(within a learning management system); 

• IP address verification, where students are required to take 
their exam on a specific computer; and 

• secure password and identification systems. 

LOW-TECH OPTIONS LOR CONTINUING EDUCATION 

The consensus among distance education administrators attending the 
UCEA conference presentation and those posting on a variety of Internet 
blogs and information sites is that as long as the HEOA does not dictate 
the methods of authenticating student identity, institutions will continue 
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to work cooperatively with accrediting agencies to ensure that current 
methods are meeting the authentication litmus test. Several administrators 
commented that this new requirement gives continuing education the op- 
portunity to take the lead on our campuses in guiding our programs into 
the future to guarantee program integrity and accountability However, 
others stressed that any changes to authenticating student identity can 
be accomplished only with the input and cooperation of our faculties. As 
several institutions noted, attempts to implement new systems within 
their online learning programs without faculty input were doomed to fail. 
High-tech authentication requires monitoring and decision making by in- 
structors, and without faculty buy-in, our institutions will waste valuable 
time and resources. 

ADVICE FROM DISTANCE EDUCATION ADMINISTRATORS 

During the UCEA conference presentation on this subject, distance educa- 
tion administrators suggested we ask ourselves these important questions 
before undertaking any new authentication and identity system: 

• What is the cost-benefit ratio of implementing a new system 
compared to retaining the traditional proctored exam system for 
undergraduate general education courses? 

• What types of systems are faculty willing to support? What are the 
faculty workload implications? 

• What authentic assessment strategies combined with a secure 
authentication system are possible? 

• How can campus-wide identity management systems be utilized 
to fulfill distance education accreditation requirements? 

• What training do we need to offer our faculty to enhance and im- 
prove the use of authentic assessment and faculty-student interac- 
tions? 

CONCLUSION 

Though the HEOA is the result of fraud committed by diploma-mill or- 
ganizations and concerns by legislators about student cheating, we have 
learned that we cannot change pedagogy for technology's sake. Currently 
our online degree programs comprise all levels of degrees, diplomas, and 
certificates. The HEOA language does not and will not expect all of our 
courses or programs to change the manner in which faculty interact with 
or assess their students. Continuing education leaders should understand 


150 


CONTINUING HIGHER EDUCATION REVIEW, Vol. 73, 2009 


STUDENT IDENTITY AND AUTHENTICATION IN DISTANCE EDUCATION 


the context of the act and its enforcement by accrediting agencies, and 
know their options for complying. Campus conversations should ensue 
about quality online teaching and learning, student interaction, authentic 
assessment, and the cost-benefit ratio. Then and only then should techno- 
logical solutions be incorporated into campus-wide discussions. Student 
authentication and identity is not a continuing education problem; it is a 
higher education problem that must be solved with input from all of our 
stakeholders. 0 

RESOURCES ABOUT STUDENT AUTHENTICATION AND IDEN- 
TITY 

The following organizations are closely following the impact of the HEOA 
on distance education, student authentication, and identity: 

• New Media Consortium (http: / / www.nmc.org/): The New Media 
Consortium is an international nonprofit consortium of nearly 300 
learning-focused organizations dedicated to exploring and using 
new media and new technologies. 

• Western Cooperative for Educational Telecommunications (WCET) 
(http:/ /www.wcet.info/2.0/): WCET is a cooperative network of 
member institutions and organizations that provides a leading 
source of critical thinking and expertise on the evolving role of 
technology in higher education. 

• International Biometric Group's BioPrivacy Initiative (http : / / www. 
bioprivacy.org): Recognizing that biometric technologies are see- 
ing increased usage in the public and private sectors. International 
Biometric Group's BioPrivacy Initiative defines best practices as 
well as deployment and technology guidelines for maintenance 
of personal and informational privacy in biometric deployments. 

• Council on Higher Education Accreditation (CHEA) (http: / / ww- 
wchea.org): A national advocate and institutional voice for self- 
regulation of academic quality through accreditation, CHEA is an 
association of 3,000 degree-granting colleges and universities, and 
recognizes 59 institutional and programmatic accrediting organiza- 
tions. 

• Higher Education Opportunity Act of 2008 (http: / / www.ed.gov/ 
policy /highered/ leg/hea08/index.html): Full text of the Act. 
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